Extracted

• • Target

    9f9a8f03e100f12030d73b34f62944c8b851eb04c06a0f9da98afd7245020e1c

  • Size

    723KB

  • MD5

    e01d061e764b307a186b15bb8742f2ba

  • SHA1

    609e349a94960cf57e396f53de2c0a3485051f5e

  • SHA256

    9f9a8f03e100f12030d73b34f62944c8b851eb04c06a0f9da98afd7245020e1c

  • SHA512

    c8c0120ab4880541c49a14234ae3ec1e572d01b778c4ab6c6feba95d58254b0c8587c985d82ff628fe54f438379bc2accada65d270869170087f49c263d851c6

  • SSDEEP

    12288:jMr5y90jseUfar5kQFlQW5mXI2m14FFozVtuFBLSIJyOywRbfI8TM+qR:6yknrrRmXI2c4FF2CB27OJRbfI8TMh

  Score

  10^/10

  redlinedizaevasioninfostealerpersistencetrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1